5c9f73bb395fe913c45e38bf0b64fa639b48e276b9977c62ff46758d0a11f4b0

Analysis

max time kernel
150s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
28/07/2024, 02:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

58a7e19686e93f3d110205a2de44e240.exe
Size

91KB
MD5

58a7e19686e93f3d110205a2de44e240
SHA1

369bb015d3e84f7ea482ef8be3d7c83311bc9e3c
SHA256

5c9f73bb395fe913c45e38bf0b64fa639b48e276b9977c62ff46758d0a11f4b0
SHA512

2d329a931068c12dbb4acbe7564fb039e7265ea61068cd792908ee34cc305dff647e010eb0d6cc35edd6392e29a47b2fc9ddc09aebc4b85faebd3935afcbaffd
SSDEEP

1536:W7ZNLpApCZuvIYXGTvnUp7ZNLpApCZuvIYXGTvnUg:6NLWpCZLYNTNLWpCZLYNg

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (1571) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Executes dropped EXE 2 IoCs

pid	Process
348	Zombie.exe
1368	_MS.EXCEL.12.1033.hxn.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Zombie.exe	58a7e19686e93f3d110205a2de44e240.exe
File opened for modification	C:\Windows\SysWOW64\Zombie.exe	58a7e19686e93f3d110205a2de44e240.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.VisualBasic.Core.dll.tmp	_MS.EXCEL.12.1033.hxn.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-timezone-l1-1-0.dll.tmp	_MS.EXCEL.12.1033.hxn.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscorrc.dll.tmp	_MS.EXCEL.12.1033.hxn.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\System.Xaml.resources.dll.tmp	_MS.EXCEL.12.1033.hxn.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.es-es.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\rtscom.dll.mui.tmp	_MS.EXCEL.12.1033.hxn.exe
File created	C:\Program Files\Crashpad\metadata.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Globalization.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\PresentationUI.resources.dll.tmp	_MS.EXCEL.12.1033.hxn.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\et-EE\tipresx.dll.mui.tmp	_MS.EXCEL.12.1033.hxn.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems32.dll.tmp	_MS.EXCEL.12.1033.hxn.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\mshwLatin.dll.mui.tmp	_MS.EXCEL.12.1033.hxn.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\WindowsFormsIntegration.resources.dll.tmp	_MS.EXCEL.12.1033.hxn.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\keypadbase.xml.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipshe.xml.tmp	_MS.EXCEL.12.1033.hxn.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.ThreadPool.dll.tmp	_MS.EXCEL.12.1033.hxn.exe
File created	C:\Program Files\7-Zip\Lang\si.txt.tmp	_MS.EXCEL.12.1033.hxn.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.th-th.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols.xml.tmp	_MS.EXCEL.12.1033.hxn.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Windows.Controls.Ribbon.resources.dll.tmp	_MS.EXCEL.12.1033.hxn.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIntegration.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.FileVersionInfo.dll.tmp	_MS.EXCEL.12.1033.hxn.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.WindowsDesktop.App.deps.json.tmp	Zombie.exe
File opened for modification	C:\Program Files\7-Zip\Lang\eu.txt.tmp	Zombie.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fr.txt.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.id-id.dll.tmp	_MS.EXCEL.12.1033.hxn.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\micaut.dll.tmp	_MS.EXCEL.12.1033.hxn.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Metadata.dll.tmp	_MS.EXCEL.12.1033.hxn.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Compression.FileSystem.dll.tmp	_MS.EXCEL.12.1033.hxn.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Emit.ILGeneration.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Text.Encodings.Web.dll.tmp	_MS.EXCEL.12.1033.hxn.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipsfin.xml.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ThirdPartyNotices.MSHWLatin.txt.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\clrgc.dll.tmp	_MS.EXCEL.12.1033.hxn.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Tasks.dll.tmp	_MS.EXCEL.12.1033.hxn.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.ServicePoint.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\UIAutomationClient.resources.dll.tmp	_MS.EXCEL.12.1033.hxn.exe
File created	C:\Program Files\Common Files\System\ado\msado28.tlb.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Debug.dll.tmp	_MS.EXCEL.12.1033.hxn.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.FileSystem.AccessControl.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\mshwLatin.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\ado\msado15.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ComponentModel.Annotations.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Globalization.Extensions.dll.tmp	_MS.EXCEL.12.1033.hxn.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\System.Xaml.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\7-Zip\Lang\io.txt.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\ShapeCollector.exe.mui.tmp	_MS.EXCEL.12.1033.hxn.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Diagnostics.EventLog.Messages.dll.tmp	_MS.EXCEL.12.1033.hxn.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.Win32.Registry.AccessControl.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\System.Windows.Forms.Design.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\System.Windows.Controls.Ribbon.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RHeartbeatConfig.xml.tmp	_MS.EXCEL.12.1033.hxn.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-fibers-l1-1-0.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Principal.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\System.Windows.Input.Manipulations.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\WindowsFormsIntegration.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\ClientCapabilities.json.tmp	_MS.EXCEL.12.1033.hxn.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\lt-LT\tipresx.dll.mui.tmp	_MS.EXCEL.12.1033.hxn.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.WebProxy.dll.tmp	_MS.EXCEL.12.1033.hxn.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Drawing.Design.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\System.Windows.Input.Manipulations.resources.dll.tmp	_MS.EXCEL.12.1033.hxn.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVScripting.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Compression.Native.dll.tmp	_MS.EXCEL.12.1033.hxn.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	58a7e19686e93f3d110205a2de44e240.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Zombie.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	_MS.EXCEL.12.1033.hxn.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3804 wrote to memory of 348	3804	58a7e19686e93f3d110205a2de44e240.exe	88
PID 3804 wrote to memory of 348	3804	58a7e19686e93f3d110205a2de44e240.exe	88
PID 3804 wrote to memory of 348	3804	58a7e19686e93f3d110205a2de44e240.exe	88
PID 3804 wrote to memory of 1368	3804	58a7e19686e93f3d110205a2de44e240.exe	89
PID 3804 wrote to memory of 1368	3804	58a7e19686e93f3d110205a2de44e240.exe	89
PID 3804 wrote to memory of 1368	3804	58a7e19686e93f3d110205a2de44e240.exe	89

C:\Users\Admin\AppData\Local\Temp\58a7e19686e93f3d110205a2de44e240.exe
"C:\Users\Admin\AppData\Local\Temp\58a7e19686e93f3d110205a2de44e240.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3804
- C:\Windows\SysWOW64\Zombie.exe
  "C:\Windows\system32\Zombie.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:348
- C:\Users\Admin\AppData\Local\Temp\_MS.EXCEL.12.1033.hxn.exe
  "_MS.EXCEL.12.1033.hxn.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:1368

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3419463127-3903270268-2580331543-1000\desktop.ini.exe.tmp

Filesize
91KB

MD5
f57020b68f8efc23ad416daedb24b64b

SHA1
c4a8af7af950c0e588ded7e4580b41d571eea662

SHA256
1e7ad54c51b13500f5ffce0a4058a45bc8d1f25e51c0abeae984c21ed5460f5b

SHA512
02af15b9d8928ca5c4c1fe98dd55ea1e966cea08f9e8d05b9d4f47cf08ebb1e2c5ae8a702d88a865b6b302eca3d11e293c7ba626d387a712c3546c00c1c3be5d

Download Submit
C:\$Recycle.Bin\S-1-5-21-3419463127-3903270268-2580331543-1000\desktop.ini.tmp

Filesize
45KB

MD5
3ad3aac7b82d3902f3864c8888418d14

SHA1
c3c73fc116af6a0f6c27bd2206d47c066edd0875

SHA256
44456e3b0fa75305492c20abd16dedc78e5413cbcf64eedb908501d6ea3d58e6

SHA512
5b01f351687cb13257baa326e4fc80c73bc1300b884ab6dd6e5b5818b103827bbc1b2e1876e78153b08f615ea70cc26b6eb601899a022809d4abc0d085ac046d

Download Submit
C:\Program Files\7-Zip\7-zip.chm.exe

Filesize
158KB

MD5
26e3f926ed3f5929463ad7f4c2514860

SHA1
9f4b21d0f5f3632dff29afad2dcb0d26878f26ac

SHA256
948750c0fc122d4fa1d6d09c00e8efd2c057ab32ed75fcda2dff11047ccd9ac2

SHA512
5fc152748eea5d23e1cbb0dfe7594e23eed7fe2a47c1c878848734729af0c4d015a0fdea171779ae0aa373600b34375404ff1a9dfa04ddf15ce92ba4411d2740

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
145KB

MD5
2ab80123e9bece621d01100280f1fc54

SHA1
3916e99f78987c05b34e9ec3fa74865e6a4029f9

SHA256
377815a9af9dd56fb0b79f843db5570b76720c2b0f98ba2a9a82b7fc02013f81

SHA512
816ce79109f449a9083c75f9410a62578c9b0a1b9556b5b3ab3e20d5509afd896f70cba7159c1fb5c1d97bff10753dc4dcc06d391aeb45d4ff9a8ee28d747021

Download Submit
C:\Program Files\7-Zip\7-zip32.dll.tmp

Filesize
111KB

MD5
7b31a969e5cf44a41b9d56066703f530

SHA1
09ec7007bd564afc6a601106dd110a578c6884d6

SHA256
6f23f73437911dc4a243cc143b49a3822e567defdcdc30e892a3d9e97c227d15

SHA512
e925a9b3e9dc5d8c4a2f11745d2ff888633612243b28f1ea1f3d248942182710cd6f4b59c8a6e3ad9d5cb9099e8d7723fa6a746d244b42405373ecae9aac2127

Download Submit
C:\Program Files\7-Zip\7z.dll.tmp

Filesize
1.8MB

MD5
20782d143120b71fc0522fa8eef0e20a

SHA1
9b452de592954725b92657802978d2255a51fd1b

SHA256
ae6b983d68a4ad832693eb49d3ad16cdf48f6a5a15d39b814f93a8379572dfaa

SHA512
751f88da2b5fd12403f914a4d9bdf8ef2edea43dd2436856130dee46aeb82c4d77150e30379187c6e65bdc5690515440998c445076ddee6ea17df3dba2c1f087

Download Submit
C:\Program Files\7-Zip\7z.exe.tmp

Filesize
590KB

MD5
4a449619cb3690dcf4555d5650a6fc3b

SHA1
cf0d0ab9ce0f7258407fff56401b9290e47eda4c

SHA256
5f99d3ea29876ee91c2f6671ac1beaaec27bff2c21776bc9a9831411f64079d2

SHA512
b8517a29f3bd5e8855ead417309535f3600e5b0143bf618dd81fb17e5d286ad01fcacdd1bab1dca7957f03733833b0f39c06687cd697e4c2e6696f786ec70efe

Download Submit
C:\Program Files\7-Zip\7z.sfx.tmp

Filesize
255KB

MD5
19b5b9df754553408dfc0681cb54a1bb

SHA1
002f27fd890c7717d9082bd77f10e1635cc25175

SHA256
ff6a6decac7d628883012546acaf1a53f2f5c079b8076084a03406957ce48ab0

SHA512
c8a2f578cd2195554107e938a7f60a892d238330045a945fffac662975dc5f4eb150ad767ab8c14be11410c4e8fc8e575daaa7a21b0bd93f0e1ee103b1dca81c

Download Submit
C:\Program Files\7-Zip\7zCon.sfx.tmp

Filesize
234KB

MD5
d007c4959549511960f8a2e1f00c1b08

SHA1
b6f784e35d33d5a23320f98489bc7bac7ae79615

SHA256
8d2bc52434d5fb83b1239a793207131defc16eae5993093dc35d25ffd8bdefc9

SHA512
ea321a585f7602fb4f74e4edea29a149bc4a1ea41cbba8b58e41ebccf186fd94215e5c5b1d05a30a7abf18ec1656d2b56f0fa87e97adf935719240af31fd62f3

Download Submit
C:\Program Files\7-Zip\7zFM.exe.tmp

Filesize
976KB

MD5
f8af8d2b59f2cf9387d4cba56dbab62c

SHA1
7a15c22054e2d4f0af4dec0d2342a17741956898

SHA256
e234c790d74067a90c26045a5c0381a97ff48d7138dc201cea32fd84007a1ad3

SHA512
e1da7faca7b518fb0822c344b2e805ae044e9b9de59d0b17bbc9522f8ade8c9911ab4765cab78396c3e228c05494ecb248832429e3a51769df971e697fcf5071

Download Submit
C:\Program Files\7-Zip\7zG.exe.tmp

Filesize
730KB

MD5
e5e759d2b131f41bc15acb66e8a5605a

SHA1
3795bd402783f24e346692232d33ffabf5188427

SHA256
bb0ad3b685fc2cbdd1e71339536fc92d9494c10f80dc278a890c1b2c854be4bb

SHA512
312199079c3db94ee28d7857f0af60ea9440c90f39c5a5e9f3800cbe8120cf7256f42a53066a1d020cbecb756c3fb0b2df599445cd3a20132cf5fdf0b50b5844

Download Submit
C:\Program Files\7-Zip\History.txt.tmp

Filesize
103KB

MD5
48b1488b137befcd176b8b24bc7ca9d0

SHA1
b81af5ad901b5806c4adec89d52e317c68106a1a

SHA256
7163356f80a4060165b6903366142c9515358c004717609fbd8ff0e83dfbf9ac

SHA512
c0cb8fdecc100e6cceac1316dd67dfd9b76b56fb7e6b27aeaad5591bb72b8fc06cdb1f8d1ed5ad45e5e0e9e1b8f4f3fdf47c59f4ae5c23d1e44ee6ed78618b1a

Download Submit
C:\Program Files\7-Zip\Lang\af.txt.tmp

Filesize
55KB

MD5
1cb2407a28b4f600adae6dd65311b40f

SHA1
cc34bf1ee6607144944f1e5ce283f3a1caf138c5

SHA256
880598b7eb76491b0d01577a5e6fcf9588548a5d0ecb8bd04ebd1c92c6ee9317

SHA512
3da84138744749153d62f23bbe6dcf17e257b604f13367eaacfec8fe722ca2aefdecf98b05049dbb7dbf8d312329ae035cccc69f5481dbcbdfa41b53a4ba2801

Download Submit
C:\Program Files\7-Zip\Lang\an.txt.tmp

Filesize
53KB

MD5
a78cf1d8945945e79af475ee9c36b9ac

SHA1
8291df4f76b22a5aa0eddcc33289f0adf20338a8

SHA256
995ef6233cbc66ef7c12391dd0aa8fad0ef51bd574b5a8697873b2bcce61701f

SHA512
6bf5e407800d9bea4d5570119d60ade51c0840c51699380d6cb127031198586d2fcdf41b20e16f72062869ce372d4cc5718f919980fc4212278882b59519c108

Download Submit
C:\Program Files\7-Zip\Lang\bg.txt.tmp

Filesize
58KB

MD5
37d39655876201980c2cb7c5fb97c22a

SHA1
740227469b04a39b7b88e5a9cdb4f93f0eba6816

SHA256
776a74cd1f4a5a1166b36379bb08efa5dfb1be11b9ec801184253c51d36f3e2d

SHA512
98d2f912baea326e3d9b18c753e16dacb7042a729d9f4465953c23c08391451a172057868af4798c294febd2eb1e019beb22e63c2a9c43720d51480622142328

Download Submit
C:\Program Files\7-Zip\Lang\bn.txt.tmp

Filesize
60KB

MD5
8142304e1b75ab76a9e96a83ddd17b07

SHA1
152ae00fe4f517b30be0ec9ee23ec9e5e1d9f718

SHA256
6424ea48a857b93a4ce03fbb8381326acdf6d4650491d8651d7562c7bca20749

SHA512
8cea79120a2e7604433a7b5786db99d954ba2f531c0045972ea15ca672f1008950cffdf408495caa244f8b54a0dcbbff617fb2b7aed7b0316b085e91dbbcbadf

Download Submit
C:\Program Files\7-Zip\Lang\br.txt.tmp

Filesize
51KB

MD5
55420d9d4e370e274cad880c99c686eb

SHA1
f5946ee292a7b3decc3c8f6fdaa907a543afe0ac

SHA256
a9a1652f5612dc06e55256b299d4d7a6270bbc3c5a8124893cc7ddfc1834e750

SHA512
9db8c4852a2918a53068bf03a275c541fd11ae0f21f61143eb7a5534d6acfc2c95fc93df072e5bb0c182a137f605d8dcfb69c56cb045d734c21b41f34e0d4661

Download Submit
C:\Program Files\7-Zip\Lang\ca.txt.tmp

Filesize
55KB

MD5
80874c2f3dccfd54cb5f963c35a2e68a

SHA1
5106544958cc42f868630e68638b0ce16495643e

SHA256
f1625bffc18802d91900c6a40f192f7731020b1410c130f67eb6cb7c92d30bf0

SHA512
f07e946dee98c23e19fde56d363ce27d8e38f20c3c38baff3ade8c4dd89143df5e6ddeac79ab031eab68c2746d09a01cdf3f3946fc543678d0b58c777da4a075

Download Submit
C:\Program Files\7-Zip\Lang\cy.txt.tmp

Filesize
51KB

MD5
84aee412b6880d14dab987c49126d4bb

SHA1
80e26cb7046aa9a67278cf05af80f7af59b589f9

SHA256
788bce56975728b31bff6e03c245a60ae7a22a1eabd546d9763e2b9483499a1e

SHA512
3032a4fb7fb991f75470359735cf10fd30f9fb3dccbc96b5c0e0df4b371bb89bc9056c638230af8aa1bcf7c870358a514b60156b3edde102e86d5a43bc2c791e

Download Submit
C:\Program Files\7-Zip\Lang\de.txt.tmp

Filesize
55KB

MD5
59af1b56f25f1e11eced0778d8875a35

SHA1
790f6b4645cb6aebdfba0f5dbcab8a44dc6f7515

SHA256
9af1d498715aaf8d7e3474bab4bc895f9f4bd4d7ce74dd5062a2f26869890541

SHA512
decb3c78b048e0762cddb22f4102578bf5e53e66bbf7c946941d1cecf65234ecc18b2d1ca12b2f5fed3efd1d059351babbe6ebb4d1561f5d0d11e5dabb1c93e7

Download Submit
C:\Program Files\7-Zip\Lang\el.txt.tmp

Filesize
62KB

MD5
95f79c1225d076a8ca61f5487c3c6385

SHA1
5cab720f79515f34f84608a6b4a525d74bc0a851

SHA256
f785f73438cdc3c07ede6ec9770db53849eb26c723133d53cbc0a7717688c091

SHA512
5a6d015f67098bf479105f8c1d729c48b02a7bb70221670d133ab605c514450bbe8b09679be8c4095f5d40d99ec10790d82367e0a6cf41d0dd7708540cf357ae

Download Submit
C:\Program Files\7-Zip\Lang\eo.txt.tmp

Filesize
51KB

MD5
c2c6b7b0ec5efa4094bf5111ff17795f

SHA1
08763bfe64e2cc52415f33ae2e8a0bd1d45013fa

SHA256
929d53adae4d2c79411360c6e22034598cdd8244ee9985de7106d3307dbbaa87

SHA512
70d87ba0bf1f2361d568cd121fdd74d07e37932fc09c1c96c94012805018090b3104266f97254d86da06203c59522348fa18e0ab7d807536afd69785e0d4d4a9

Download Submit
C:\Program Files\7-Zip\Lang\es.txt.tmp

Filesize
55KB

MD5
22dc57991601fcd0c240b7a0b1cb3d43

SHA1
d20a63e05ecd617fa74b5076e0b74c1d1f4ad539

SHA256
58e296a7a61cd5071a33a1eda7b9b3a964d1b60d9ce41bc72e3b20be80fd7ec4

SHA512
eda8b09f2f89e42e5fcc161aa5d2d7dc98464d4774aac8b7c4554bb347dbb55f386fe7a952cbe99dbe0c30e8a71af0c88759f5054c295ca0f857e4978f122dc5

Download Submit
C:\Program Files\7-Zip\Lang\et.txt.tmp

Filesize
53KB

MD5
f4bea33b899a0cf70aff2a537065550a

SHA1
b3664f2fab07f462a74fe5287604df6d0f30e309

SHA256
ba2558e646738548c4e55828fdaa9fdef62bc78204a675b4f328ed0675fd25fd

SHA512
d0cc1dddd69d98de3ac3ee7e59e762cccf0415abae7bf3994ab3e77f320530dff2c03fd96a57e2b9ad875358383e29ec7ac26ae584841c983026cb00576ae563

Download Submit
C:\Program Files\7-Zip\Lang\eu.txt.tmp

Filesize
54KB

MD5
8dae83be2ee0d05ec96f8951dc18e5f9

SHA1
fa7ddddca73ed2d83d7d58164f4e8667fd8be237

SHA256
009e7904bbe14a284eb42dcf483555de6b72cd0d2d7e0f93af67cd0e09f4b2c6

SHA512
ef88b666924dc9ef951aae3380d1aa128af385e0afcc2a2f73a0c5f3b29e35063dcb625c195eaa5197427e128fa1a45f2e0037c035afdb1909c7506586c7a421

Download Submit
C:\Program Files\7-Zip\Lang\fa.txt.tmp

Filesize
59KB

MD5
777acbb8243bb7e012c4218fb3185957

SHA1
e546862f87f7b3ece13537d02cc4f8899351237a

SHA256
96a056b0bf19eb96c7d828e860de068bbcbab85fc77c39547ddf2c2c1221e282

SHA512
8f220c6f8c67d7f9b239162d92362f43e9770c30e280bfbd40174ac61a6e9f393ebc9126e85b0f062a6071f2a65c1414dc27b2ebe634e655ec4c43eac14c7b69

Download Submit
C:\Program Files\7-Zip\Lang\fr.txt.tmp

Filesize
55KB

MD5
06c80016373d991effe551883877b47d

SHA1
719da4b796b05f6a49896e388ad8de1d7e5be644

SHA256
d9bea61c4b4a09c0a35d154c7660aba4af97c7019c481d507f73d9939c821a82

SHA512
01018ce095c27332ab2b09d024e76c0dd4d2dafd81309f5888be7d3cfcdf472e74244bf34ff59ce4626d06a1055a113114862ba3e1aa49ae030f1da6bed4c307

Download Submit
C:\Program Files\7-Zip\Lang\fy.txt.tmp

Filesize
51KB

MD5
d21e77df25f167b8402b304efdaab0d0

SHA1
3b918735cf33e6234c2d2831637496e37f1652e2

SHA256
4416d0ea19378f00ca0b590e34e8c4a481e504b7875936c9b6908fd1cc43aa4b

SHA512
3f725fb1fe90f20323cb17de5e40632fef36fa060bf296850b84e858f574506d01a3bd68d95f9daf7b6531beaa0444c419d31cc58596d32123c65bdd203e3f97

Download Submit
C:\Program Files\7-Zip\Lang\ga.txt.tmp

Filesize
54KB

MD5
02aeff40941fb69669959c08b6caf7a1

SHA1
e70b6f755eb68b822d230154362bb6d67f7e135a

SHA256
2add30545a07f79f67a7436236d2c10d50726c07fc0299706c64a6954c184d7a

SHA512
2d3c2d76e87891ef52369294374a110525863f4f2d1f12f0cb75cffb0e853986281b287dec866fd61cf1cb6a64717eb68a213cc4efd195df68a8b205dc0345c6

Download Submit
C:\Program Files\7-Zip\Lang\gl.txt.tmp

Filesize
45KB

MD5
395fca60378fb154e04ce37e5c87a896

SHA1
1e9187c146e52f4b6850871817d323564743eabf

SHA256
d8a70db60296598e94d8d350ee2219fa9646e77c3168b49e708b88c5ba9f7e2b

SHA512
70f71b6364510646588c2d9b2b059c7df90322d85ff443679aa7ada3ceaeaa4b7f4fe48899778114777bdb3e3d980c5003709ff82de55e48a896fb17cfd153af

Download Submit
C:\Program Files\7-Zip\Lang\gu.txt.tmp

Filesize
63KB

MD5
27d557bb3bdbeedf93b4ce65266d3a95

SHA1
827cbb5d6be24ef74e63c3581dbbef1e8f32f570

SHA256
87a2ed96d218dff37357a7817aa5b85e9adbfdc6d0b09b3253e615b0fcf8d71b

SHA512
6e6a7520e0302d71ac7b6bf074a4e0847cab8b970e23d4942bcd24d6a46a4436d3ff0abbe6590a5df66b4ec1f7214227d56763513a3b9ea21867181753939436

Download Submit
C:\Program Files\7-Zip\Lang\hi.txt.tmp

Filesize
63KB

MD5
88ce7a5816b92681c4a60b7e4d8d7a2f

SHA1
74c85f09dc02b97fe99e7efc8e97e7b5ad983992

SHA256
8c8c3f6edc99d6e87df861e21a6a5016a9803bc7aae96124d888b3c00adabb53

SHA512
c63a9436a12b82bb80208da2213077781ad860ca7831b46c1f4795b88e316f4881c1071356cc6c5820d442ae65083eeae421808aca9fe402141d4be2cbbedc31

Download Submit
C:\Program Files\7-Zip\Lang\hu.txt.tmp

Filesize
55KB

MD5
1c0066ca2cdfa160fb9233fbdd558d3f

SHA1
3c930e67e99b5c71ffc12c3c38e5d02c98ea862a

SHA256
cf811381d643fcb2dd50d5abdf16fd8d43998bd86c265b49eb6d57cc753a5f6c

SHA512
1509d1475c0b07d4c87a89016f9011aeaeb2fc546e2c0a66a927c0acdaa03869f0640a9bafd72cf38b197e86fa918128b7151f47dc0e4f59b310c6b96746781a

Download Submit
C:\Program Files\7-Zip\Lang\io.txt.tmp

Filesize
55KB

MD5
a81161de23522e67056e64f502cf1a83

SHA1
f74ccb7218705841166a9cfccbaae0f3495145e8

SHA256
fa5388db157a61731383bb808761b3d4d7bb8cea6e14c961deeca2cc6fb796cb

SHA512
3bf7da4915e48d5c9a76beb9bca9c4cf778e59941b56fe23b3cf36b13530de8e52dd99a6e282f3af71f0e91bf0daabba02eb8740b90e76abe329420210e46e77

Download Submit
C:\Program Files\7-Zip\Lang\is.txt.tmp

Filesize
46KB

MD5
f112fb610574d175e763e153926fa008

SHA1
e9844d6de96b51e6fcac75181dc23354aedcc843

SHA256
391c83c06180250916612e155a238524f4e6c12ef4729c50c5ad526081b7440b

SHA512
4dd77bcb8a2b04246e1cc4592923904a41fccc8f68e8652f7b63ff7ab01cc0fce5856767232e2afd4d3c215bbd13317ae16e071d012a664b2110ffed2a724ff5

Download Submit
C:\Program Files\7-Zip\Lang\ka.txt.tmp

Filesize
63KB

MD5
9125f4dec8aa6f3767915cca97d11241

SHA1
2040ba5a1be88317f17bb1ff1c3a5f3020487461

SHA256
8f63e9734084e1f8441653a13759be6ca30436d00ca030ef8be24e5db6c306ec

SHA512
0e1e823a46f338b7c513b86df76e83ab604de387b0e4fa3e4c6d86f8b9168b0ee02a50cc9020d77355fdec44d37e7ae0711d4b17ae4f3dda70626b9e6b41c3a6

Download Submit
C:\Program Files\7-Zip\Lang\kaa.txt.tmp

Filesize
45KB

MD5
c5d31fd74773d6985f3744220e35fa22

SHA1
fd1b32ced7f2004112711da60d29251e2b3f7cea

SHA256
4f8316a97ab12b8a430cfa3ec9ab8caa608ad017fdf21f83f46e33bd66d17618

SHA512
04ec3c1eabe75d1195d1839fb357950ec7c892e38754892c0429afda409c7e88b1017abf482e174d08b6349ec2703590c7182f049f849b624582c8c084f0334a

Download Submit
C:\Program Files\7-Zip\Lang\kab.txt.tmp

Filesize
46KB

MD5
387290ec4ba738833c28fb46ec13920a

SHA1
e00ce571d0a626e02fed850d95aa672f2b988b15

SHA256
8fdc9cfa048775ce98d4cae8b3704af0af53e03219455c3e8bdc3e46f8943739

SHA512
e61e402551b5f68c51a85e18e5e283eb00e947ccb4f8d5f941828a4557d656106ce716da89def37bb0effb3fcb62df506af9ec0be25eb5fc635ae8603278dee0

Download Submit
C:\Program Files\7-Zip\Lang\kk.txt.tmp

Filesize
56KB

MD5
3a3b802901c9ea3826acb9256b1af6c4

SHA1
1df4d999a206f2fda6fe8c8347d0ba121eb12b9f

SHA256
bf9b7fde4d72439eb0940042e758a557c80df69e0333d9c44e09f279dcf0cf15

SHA512
1fce8e5c643f3da651ff5c632023b36aaa73f40d46378ee418981a6285e717d9392541d2e189546992f26f25ba098a7a32404406dc8c7e9ff76453cce7dca2bb

Download Submit
C:\Program Files\7-Zip\Lang\ko.txt.tmp

Filesize
56KB

MD5
0baf9a5bdf8b38c1c9244be1848132a4

SHA1
e479e28b615728999b95c3682cd74872545fb2fc

SHA256
f3ffe83ef1d364ea33fd0aa472e2e3de7c922ca02255005a2465695d5356e19a

SHA512
27e6767c24285365203ab52e07e6c0bcd1e007e85d9896f987346b75e2733d7228f0e4aba6066f2d474d2c6bcaa9f68e5c65a55f727e3907dd1c6cd73cd3c90d

Download Submit
C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp

Filesize
58KB

MD5
f84ddaa785676b74718967108cefb396

SHA1
1619a7b907d035b0f0cf5aa8b1ce8ee78c8836d1

SHA256
bc91e07e3f4089e7f74c8931a0ee70fdf921705f88318b1f478f88b3cdd7b320

SHA512
fc1dfc5790be91388ae132c60e5cd1ab7063ea9ec884f40b5021632b699c4620f9d4153abb63bcd196d2bb100bed45657c1909cd13145a51d152da505e3fe5d1

Download Submit
C:\Program Files\7-Zip\Lang\ku.txt.tmp

Filesize
46KB

MD5
7efab0083852b6e845860fc3ce1539fd

SHA1
b8e19993032473afae4bba6a6b928b32f6cfda4e

SHA256
ac74669f615e1d606dde458af64c1ffee145cd20ea92c3cdd546ee009a398153

SHA512
445207628f479d53ce26ff1147316292dad005a33d164990fec9d0f09f6493ec9b684128d232a2830746ba9ec07cf6e1f09c34e2d80035a4139d6e144e4e79fc

Download Submit
C:\Program Files\7-Zip\Lang\ky.txt.tmp

Filesize
58KB

MD5
c132a7c712b7472d6cbb651f7acd87be

SHA1
2cdd64d8c3584f2a935975694fde0cfa82dd0cd4

SHA256
af676da409a533ad45cdf0265e9f408cf115b5d90c5832ce40b2dedfbf25c887

SHA512
297131685cea8e5add4ff2aedbdfb08d809181b0366ffdd1e7db51dbd30c642a4461ee5791eba6fdc2157fc84ecf7aebb87fd588f436f8f341910fa3271b4955

Download Submit
C:\Program Files\7-Zip\Lang\lij.txt.tmp

Filesize
53KB

MD5
d1b5aa76f6c13252453c9d7ecc945d41

SHA1
a9cf712435f7188de50d091395913fdbd0c86b0a

SHA256
78216819dcbe3c118553d0488c7a771a2b46d2c7f305c5cfa22269bfafe4ee3a

SHA512
3e7837d987fed13be3dca8d77f8479435ba4b6682447b3d3fc9af4b40458ff23c428e42f289c0a0ecc5d1d22e045ded3166a740433359cc206c87273418fe3e4

Download Submit
C:\Program Files\7-Zip\Lang\lt.txt.tmp

Filesize
55KB

MD5
68136e30d23eb7c75306efab0461c76d

SHA1
f607c9ff61dad75ba8537e312b5f07062f6793c8

SHA256
795d5d406e95e1b1994fe057e376c81852c7e3dbc93df5a1d34efcd40907ed2e

SHA512
657c3046e78a3636d10663fd4c14728af8a25af9255e9f29fffbb07967e19155bd69e5a990e89a574cabf943ffec025148318638683f5810e7c24e32259d155f

Download Submit
C:\Program Files\7-Zip\Lang\mk.txt.tmp

Filesize
54KB

MD5
28f5a5c6a02550585c0d5ccc81d9536a

SHA1
6090af1bd2ed2765172bb8845c1edbf5bdc652d4

SHA256
979cadbed4c37b4be6cc2cd7f1e0aa6d76c18f0ec8bd468ead6e7f201b553f5f

SHA512
04b40d1213b6000fb31d24e792bb1460e458e7575ab1fede8600358c704498394b45f1d3dcc18cdd3bef16f6c40558ea8cffb1381a0a005f78220173dd9de2ff

Download Submit
C:\Program Files\7-Zip\Lang\mn.txt.tmp

Filesize
54KB

MD5
6a115fc30c0ac949892bfbc496bd5b67

SHA1
62bfd218b579a524e8092a2b606341e083d52a36

SHA256
3db5ccbbb216f2ec0c948f6604b51eda374dc934fe01356cb8e416fe201f92bf

SHA512
24c81aa939ab0e97387ef02ada6eee249e36271b380bd2335391b849e92313b9ec1e2a6e9c3ea983c6a4607e5652fdb94021700bb5e1d9f3193a0981ae846d97

Download Submit
C:\Program Files\7-Zip\descript.ion.tmp

Filesize
45KB

MD5
8344eb7bb5fe797be5c875acd6694a58

SHA1
b87c9e8d039bd9911a724597a2ce7fa4c0018c3a

SHA256
b57bf837a7a2729f030fcea5b218735b7547b2807184a90636401dae903775a2

SHA512
6d8bc87962490799e36bf8ad9067b89f1fc61ac4f1e17686fc2927628073f25b42d39a7fed29d24e43ab0cfcda5310523f8aaf638611d766a215e4c11294eb3a

Download Submit
C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\UIAutomationTypes.resources.dll.tmp

Filesize
63KB

MD5
c5d8ea0f796d47072bc970ead46a024e

SHA1
2c1ced3d0cd2f1d56352ff5aaf77450ca5aac752

SHA256
680d4af4e0d2c079bce27574ee115433f03e140fadab9cbb0ee6c2a5f9f6696a

SHA512
d7080010f62039840bc1b62a8d46ba7d1affb144e5bc3dc5b0a101680cfaf001a0aade2a5a63a06bb6e04cdb57dd5eb344b995d9a90adbb9185862b6eb4b3508

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MS.EXCEL.12.1033.hxn.exe

Filesize
46KB

MD5
6be7388aface548ea4b959552e7c7dda

SHA1
e9e14f182ea265ef6c18658834ef59aac2eef022

SHA256
acc5ed62a7153a50ac1093d22c53c14fc9f9cb61e0b643ad1036e0d1c7f76d73

SHA512
bd9e0ca977f38ce80cd26f049227672c8e21174ab6a04aaee76ef0620cddb465fde9991c1f5945e1dfc8c6f792896d70bde1fefdbf77dcbf2a3c8513b551ba1c

Download Submit
C:\Windows\SysWOW64\Zombie.exe

Filesize
45KB

MD5
1d58d6d5ab67e6944cd9786a07e84c86

SHA1
300be4114f3cde2c61358bfd0ecfd22a748f17c6

SHA256
4ab14677e939357cee01074aa9ac4781b7a4676d52d50adf027e32168858fc48

SHA512
bc3492a53df056e6403e9f02895fbe2a8f67fc64630b10bd853b57989cbfc37c38f1e5d2b0a71f2c66452aad4c041d3d784638465a8327861eeeb6ea971469f4

Download Submit